Security Guides
Does paying a ransom get your data back? Myth versus fact
Five common ransomware negotiation myths checked against what the NCSC, US Treasury and No More Ransom actually say, with the limits of what is known.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does Matter make a smart home secure? Myth versus fact
Matter builds in encryption, attestation and secure updates, but it does not secure the whole product. Common beliefs checked against the Alliance paper.
Oct 18, 20263 min read
Security Guides
Does HttpOnly stop XSS? Myth versus fact
HttpOnly hides a cookie from JavaScript, so it limits what a stolen script can read. It does not stop the script from running or acting as the user.
Oct 18, 20263 min read
Security Guides
Does Galileo OSNMA stop GPS spoofing? What it does and does not do
Galileo OSNMA signs navigation data so receivers can check it is genuine. That makes spoofing harder, but it does not prevent spoofing or jamming.
Oct 18, 20263 min read
Security Guides
Does encryption exempt you from breach notification? Myth vs fact
Encrypted data is often assumed to avoid breach notices. The FTC says encrypted data counts as unencrypted if the key was accessed. Myths and facts.
Oct 18, 20263 min read
Security Guides
Does CORS stop CSRF? A myth versus fact explainer
CORS decides which sites can read your responses, not which can send requests. Learn why a strict CORS policy does not stop cross-site request forgery.
Oct 18, 20263 min read
Security Guides
Does a low EPSS score mean a vulnerability is safe to ignore?
A low EPSS score is not a safety label. Myths and facts on small probabilities, KEV-listed flaws with low scores, and what a near-zero score really says.
Oct 18, 20264 min read
Security Guides
What leaks into your container image without a .dockerignore file
A broad COPY sends your whole build context into the image, including env files, git history and keys. Here is what to exclude and how to check.
Oct 18, 20264 min read
Security Guides
A ten-minute Dockerfile security review checklist
Twelve questions to ask of any Dockerfile in a pull request: base image, user, secrets, downloads, packages and runtime settings, with the reason for each.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.